Quick answers
- Is CVE-2026-114259 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114259 being exploited in the wild.
- How severe is CVE-2026-114259?
- High severity, with a CVSS score of 7.3, published 21 October 2026.
- Which products and versions are affected?
- Oretnom23 File-Management-System-Php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4.
- Is there a fix for CVE-2026-114259?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-114259 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-114259?
- Check whether you run Oretnom23 File-Management-System-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The save_files() function in admin_class.php accepts uploaded files with no extension whitelist, MIME type validation, or content inspection. The uploaded file is moved to a predictable location in the web root (assets/uploads/) with a timestamp-based name, and the vulnerable ajax.php endpoint has no session verification, allowing unauthenticated remote file upload and execution.
Affected products
- oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
Timeline
- 2026-10-21: disclosed